public inbox for gdb-patches@sourceware.org
 help / color / mirror / Atom feed
* [PATCH v3 0/3] Fix some use-after-free errors in varobj code
@ 2022-07-08 10:37 Lancelot SIX
  2022-07-08 10:37 ` [PATCH v3 1/3] MI: mi_runto -pending Lancelot SIX
                   ` (2 more replies)
  0 siblings, 3 replies; 9+ messages in thread
From: Lancelot SIX @ 2022-07-08 10:37 UTC (permalink / raw)
  To: gdb-patches; +Cc: lsix, Lancelot SIX

Hi,

Here is a V3 for https://sourceware.org/pipermail/gdb-patches/2022-June/190172.html.

Pedro did notify me off-list that with V2 he saw errors on his system which has
separate debug info for system libraries.  It turns out that the fix I proposed
in V2 did not account correctly for this scenario.

It is possible to reproduce the problem with V2 by testing using the
cc-with-gnu-debuglink board.  This V3 ensures that we account correctly for
separate debug info scenarios.

Noticeable changes since V2:

- The series is rebased on top of current upstream
- Patch #1 is unchanged.
- Patch #2:
  - Change lambda indentations according to the guidelines proposed by Pedro in
    https://sourceware.org/pipermail/gdb-patches/2022-June/190457.html.
  - Fix the separate debug info scenario.
  - Extend the testcase so the entire test is executed once as before, and once
    using gdb_gnu_strip_debug to exercise the separate objfile scenario. This
    would have caught the error.
- Patch #3: Adjusted the test part to apply on top of patch #2.

All feedback are welcome.
Best,
Lancelot.

---

Hi, this is a V2 for https://sourceware.org/pipermail/gdb-patches/2022-June/190138.html.

Noticeable changes since V1:

Patch #1:
  - Added a hunk which somehow slipped into patch #2 in the previous iteration.
Patch #2:
  - Address Andrew's comments.
  - Removed the change in gdb/testsuite/lib/mi-support.exp as this change really
    belonged to Patch #1.
  - Reworked the testcase
    - Only rely on dlclose to trigger the new code. Do not reload the binary
      and restart the process as this involves varobj_invalidate.  This part of
      the test is moved to patch #3.
  - Remove the var->root->exp == nullptr from value_of_root as this case
    cannot happen as discussed in https://sourceware.org/pipermail/gdb-patches/2022-June/190171.html
Patch #3:
  - Reworked the testcase to highlight that a varobj tracking a global from
    the main executable is re-created when reloading the process while a varobj
    tracking a global in a lazily loaded shlib stays invalidated.

---

Hi,

This series aims at fixing some use-after free errors we have observed around
the varobj code.  When a objfile is freed, the varobj can keep references to
the objfile and to objects that used to live on the objfile's objstack (types
among other things).

This can mainly be observed when debugging code which loads and unloads shared
libraries during its lifetime.  Without such scenario the problems exist but
are rarely exposed as the references to freed memory are not used.

The first patch of the series was originally written by Pedro.  It improves
mi-support.exp so `mi_runto` now accepts a `-pending` flag, which will be used
in the following patch.

Patch #2 fixes the actual use-after free errors by ensuring that we clear all
references to the objfile before it is freed.

Patch #3 fix some inaccuracies in the current varobj_invalidate mechanism which
is used to invalidate/recreate varobj when loading a new objfile.

All feedback are welcome.
Regression tested on x86_64.

Lancelot SIX (2):
  gdb/varobj: Fix use after free in varobj
  gdb/varobj: Fix varobj_invalidate_iter

Pedro Alves (1):
  MI: mi_runto -pending

 .../gdb.mi/mi-var-invalidate-shlib-lib.c      |  30 ++++
 .../gdb.mi/mi-var-invalidate-shlib.c          |  43 ++++++
 .../gdb.mi/mi-var-invalidate-shlib.exp        | 137 ++++++++++++++++++
 gdb/testsuite/lib/mi-support.exp              |  68 ++++++++-
 gdb/value.c                                   |  27 ++++
 gdb/varobj.c                                  |  86 ++++++++++-
 6 files changed, 376 insertions(+), 15 deletions(-)
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib-lib.c
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.c
 create mode 100644 gdb/testsuite/gdb.mi/mi-var-invalidate-shlib.exp


base-commit: 97a8d0ab534d0353c8585816fe400ef2a468c30a
-- 
2.25.1


^ permalink raw reply	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-07-26  8:01 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-08 10:37 [PATCH v3 0/3] Fix some use-after-free errors in varobj code Lancelot SIX
2022-07-08 10:37 ` [PATCH v3 1/3] MI: mi_runto -pending Lancelot SIX
2022-07-15 17:34   ` Tom Tromey
2022-07-15 17:38   ` Tom Tromey
2022-07-08 10:37 ` [PATCH v3 2/3] gdb/varobj: Fix use after free in varobj Lancelot SIX
2022-07-15 17:58   ` Tom Tromey
2022-07-08 10:37 ` [PATCH v3 3/3] gdb/varobj: Fix varobj_invalidate_iter Lancelot SIX
2022-07-15 18:16   ` Tom Tromey
2022-07-26  8:00     ` Six, Lancelot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).